FreePBX 13: From Cross-Site Scripting to Remote Command Execution

1 Dec 2016 by Hendrik Buchwald

FreePBX

FreePBX is a web-based graphical user interface that helps users to manage voice-over-IP services. According to the creator, there are over one million production systems using FreePBX worldwide and 20,000 new installations monthly 1. It is the most widely deployed open-source PBX (Private Branch Exchange) platform in use across the world.

Recently, the announcement of a critical security vulnerability caught our attention that was fixed in August 2. Since FreePBX is written completely in PHP, we decided to throw it into our code analysis tool RIPS. The results were more than surprising…

Read More ...

Announcing the Advent of PHP Application Vulnerabilities

25 Nov 2016 by Martin Bednorz

Advent

As the year is slowly coming to an end and the Christmas decorations are starting to brighten up the streets, we at RIPS Technologies decided to give back to the wonderful community surrounding PHP and information security. Starting on December 1st, we are going to open one gift of our advent calendar each day until the 24th. Our gifts are technical blog posts about specific real-world security vulnerabilities in open-source PHP applications that examine PHP security characteristics and how to avoid common pitfalls.

Read More ...